How should the nRF 5340 CCM peripheral's MODE.DATARATE field be set when using the peripheral in asynchronous mode (i.e. not encrypt/decrypt-on-the-fly)?

RE: How should the nRF 5340 CCM peripheral's MODE.DATARATE field be set when using the peripheral in asynchronous mode (i.e. not encrypt/decrypt-on-the-fly)?

Sigurd — Thu, 20 Jun 2024 13:01:03 GMT

Hi Kevin,

Our IC team have done simulations with the nRF5340. It confirms that the encryption is not influenced by the MODE.DATARATE setting. The timing values you provided are quite big. One issue could be that other masters are accessing the same RAM slave while CCM is active.

Questions:

Is there any master other than CCM accessing the RAM slave during this time?
Are the timings that are mentioned always the same or is there some bigger variation?

The MIC mismatch dependency on DATARATE is also strange. Question:

is the ERROR event observed in any of these cases?

To further investigate this, we would need to a small separate test code, that can run on the nRF53 DK, that reproduces this (write random data to RAM, run encryption, run decryption) and check if the timings are more reasonable then (measured either with internal TIMER or bring the relevant tasks/events out to GPIOs via PPI). Would you be able to provide some stripped down/ small sample that reproduces the issue?

RE: How should the nRF 5340 CCM peripheral's MODE.DATARATE field be set when using the peripheral in asynchronous mode (i.e. not encrypt/decrypt-on-the-fly)?

Sigurd — Thu, 16 May 2024 15:04:22 GMT

Hi Kevin,

Sorry for the delay on this. I have asked our IC designers for input on this.

BR,

Sigurd

RE: How should the nRF 5340 CCM peripheral's MODE.DATARATE field be set when using the peripheral in asynchronous mode (i.e. not encrypt/decrypt-on-the-fly)?

Kevin Doss — Fri, 19 Apr 2024 14:50:38 GMT

1) Sorry the typo is that I should have said "the encrypt operation takes significantly MORE time" not less time.

2) The scratch area is 96 bytes (16 + MAXPACKETSIZE)

3) MODE.LENGTH = Extended

RE: How should the nRF 5340 CCM peripheral's MODE.DATARATE field be set when using the peripheral in asynchronous mode (i.e. not encrypt/decrypt-on-the-fly)?

Sigurd — Fri, 19 Apr 2024 11:12:46 GMT

Hi!

[quote user="Kevin Doss"]For example, when I encrypt a 58-byte PDU with MODE.DATARATE = 1Mbps the keystream generation takes 19.5 usec (MAXPKTSIZE = 80) and the encrypt takes 37 usec. When I encrypt the same 58-byte packet with MODE.DATARATE = 2Mbps the keystream generation takes 13 usec and the encrypt takes 232.5 usec.[/quote]

1) Is this a typo, or does encrypt actually take longer time with MODE.DATARATE = 2Mbps ?

2) How big is your scratch area?

3) Are you using MODE.LENGTH = Default or MODE.LENGTH = Extended ?

RE: How should the nRF 5340 CCM peripheral's MODE.DATARATE field be set when using the peripheral in asynchronous mode (i.e. not encrypt/decrypt-on-the-fly)?

Kevin Doss — Thu, 18 Apr 2024 15:21:32 GMT

A couple of other observations in case they may shed light on the issue:

- When I perform an encryption operation with MODE.DATARATE = 2Mbps the duration of the encrypt operation take significantly less time than the 1Mbps case. For example, when I encrypt a 58-byte PDU with MODE.DATARATE = 1Mbps the keystream generation takes 19.5 usec (MAXPKTSIZE = 80) and the encrypt takes 37 usec. When I encrypt the same 58-byte packet with MODE.DATARATE = 2Mbps the keystream generation takes 13 usec and the encrypt takes 232.5 usec.

- When I encrypt on the sending side with MODE.DATARATE = 1Mbps but attempt to decrypt on the receiving side with MODE.DATARATE = 2Mbps some decrypts are successful and some fail. For example, I encrypt and send a 64-byte PDU followed by a 9-byte PDU (MODE.DATARATE = 1Mbps). On the receiving side I decrypt using MODE.DATARATE = 2Mbps and the 64-byte PDU fails due to a MIC mismatch but the 9-byte PDU is successful. The failed 64-byte decrypt takes 13 usec for keystream generation and 22 usec for the decrypt operation. The successful 9-byte PDU takes 13.5 usec for keystream generation and 128.5 usec for the decrypt operation.

- Code snippet for initialization of the CCM peripheral:

NRF_CCM_NS->MAXPACKETSIZE = SHU_MAX_PAYLOAD; // 80 bytes

NRF_CCM_NS->HEADERMASK = 0xFF;

NRF_CCM_NS->SCRATCHPTR = (uint32_t)&ccmScratchArea[0];

NRF_CCM_NS->SHORTS = CCM_SHORTS_ENDKSGEN_CRYPT_Msk;

NRF_CCM_NS->INTENSET = CCM_INTENSET_ENDCRYPT_Msk | CCM_INTENSET_ERROR_Msk;

NRF_CCM_NS->ENABLE = CCM_ENABLE_ENABLE_Enabled;